Siemens has confirmed that threat actors exploited a vulnerability in its Software Center as part of a malware campaign. The flaw, tracked as CVE-2026-110936, allows an authenticated local attacker to execute malicious code by placing a malicious DLL file in a folder searched by Siemens Software Center.
Siemens released a fix in Software Center version 4.0.9.8. Existing installations will receive the update automatically when users next launch the application.
According to Siemens, threat actors used a legitimate, digitally signed copy of the software and malicious DLL files to load the code.
“The attackers used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it. They chose this program as a carrier because it is signed and trusted, and because version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them. The Siemens program was not modified. The malicious code is in the DLL files the attackers supplied, which the vulnerable version loaded when it started,” the company noted in its press release.
Siemens linked the activity to Romulus, a multi-platform ClickFix campaign that tricks users into running malicious commands through fake prompts, such as bogus CAPTCHA checks.
The campaign was previously detailed in Forescout and Huntress reports. Forescout researchers discovered the platform operating across multiple servers, including the distribution server Siemens had identified as hosting the malicious bundle containing its software. Forescout observed the platform distributing the LegionLoader malware and a trojanized installer that abused a legitimate Stardock application to perform DLL side-loading.
However, the researchers were unable to identify who operates Romulus. They noted that it could be a privately developed tool, a service offered to cybercriminals, an affiliate framework, or software copied and used by multiple threat actors.